Remove server id and expiry #99
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Otherwise, the compiler isn't checking the signatures between the implementation and the header.
zanebeckwith
force-pushed
the
no-id-expiry
branch
from
2aeab50
to
95a4e3a
Compare
This is following the recent change to the XTT spec.
To allow for the new validity dates, we had to switch from UTCTime to GeneralizedTime. According to the x509 RFC, the validity period for a certificate that shouldn't expire SHOULD be 99991231235959Z. Similarly, the earliest-possible GeneralizedTime is 00000101000000Z.
zanebeckwith
force-pushed
the
no-id-expiry
branch
from
95a4e3a
to
2d493d0
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Following this issue and this issue in xtt-spec, this series removes the server ID and expiry fields from the server certificate, and replaces them with a single "reserved" field of the same total size (to maintain backward-compatibility).
As part of this, this series also updates the ASN.1 key-wrapping to create x509 certificates that don't expire (by using the earliest-possible notBeforeDate and the recommended notAfterDate).
The tool still allows the user to specify a file with 24 bytes to insert in the "reserved" field of the server certificate. However, the default is to use a value that corresponds to Xaptum's production server ID and a non-expiring expiry (December 31 in the year 9999). This way, any existing clients that still check server ID and expiry will continue to accept the new certificates.
closes #91 and closes #79